ci: an empty selection must build nothing, plus selector follow-ups (#3845)

ci: an empty selection must build nothing, plus selector follow-ups

A PR whose build axis legitimately selected nothing rebuilt everything.
build.yml reads .build.families twice - as a |-joined regex, and implicitly
as "is anything selected" - but tested only -z "$FAMILY_REGEX", which an
empty list and a charset-rejected one both satisfy while meaning opposite
things. ci_set_matrix had already returned the correct all-empty matrix;
the fall-open branch discarded it. #3842 and #3840 each spent 74 cmake legs
on it. Branch on the two cases instead, rename FAM_* to FAMILY_*, and cover
the block with a test that extracts it from build.yml and executes it - it
had no test at all, which is how this shipped through two merges.

Follow-ups to the same machinery: glob.escape the repo root at five sites,
so a checkout path containing [ or * stops failing closed; drop the ci-full
label, read after the matrix was already computed and so never functional;
delete 13 mcu:MKL25ZXX / mcu:SAME5X skip tokens matching no board; carry the
rule table in the module docstring, guarded against drift; and pin six
selection behaviours a mutation pass proved untested.

Cut the selector's cost 1.8x (26.0s -> 14.6s) with 0 divergences over 260
paths, and stop scoping the membrowse upload by the PR example filter.

1 files changed, 7 insertions, 1 deletions

diff --git a/.github/scripts/ci_set_matrix.py b/.github/scripts/ci_set_matrix.py
index 79f466893..409e6dbc1 100755
--- a/.github/scripts/ci_set_matrix.py
+++ b/.github/scripts/ci_set_matrix.py
@@ -131,7 +131,13 @@ def set_matrix_json(select=None):
         # a family this file does not list builds on no toolchain, so it contributes no
         # leg. hw/bsp holds several CI has never built (efm32, py32f0, same7x, ...) plus
         # espressif, whose boards hil-build-esp builds by name.
-        unbuilt = sorted(f for f in sel_fams if f not in family_list)
+        # espressif is not a gap: its examples need the ESP-IDF environment
+        # (CLAUDE.md: `. "$IDF_PATH/export.sh"` before any build), which the cmake legs
+        # do not have - that is why it is commented out of family_list above. Its
+        # coverage comes from hil-build-esp, which builds those boards BY NAME in an IDF
+        # container, so an espressif-only PR is already validated and falling open to the
+        # full matrix would add 74 legs, none of which can compile espressif.
+        unbuilt = sorted(f for f in sel_fams if f not in family_list and f != 'espressif')
         if unbuilt and not any(matrix.values()):
             # NONE of the selected families is buildable here, so every leg would skip
             # and the PR would go green from a build job that ran no compiler. That is